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, 7 ^ ^ fllSf Ir -^;i/2035S:«^5, OSIHCTRL203 

4 tufflo s 201 onffijciotu v-x^r^-fe^-rsift^srssai-s^ 

[0 0 6 0] 

r 9 1 - n> 2 o 3 5 «, 03 &c^-r<ke>ic, y v-**gjgft?R 

2 0 3 5 1, ^f^2 0 3 5 2, n f@(Z>7 # -fe XtiPH'ff^g 2 0 3 5 3~2 0 3 5 n 
£ U y-^#jc^^prtgfC^^$tlTVN§ 0 
[0 0 6 1 ] 

U y-^ll^'ffl§2 0 3 5 1 ^IMOS2 0 0 

2? a:* h 3: a*"** "72? a:* h£, T Kl/*& JxS. *t^P^fi© 

[0 0 6 2] 

^ff2 0 3 5 2(t 7 V^xmmtf^m fc.lZ^0ft3.fr&£> J £$: L . 

.^r - %/ b y & $ *i -5 . 

[0 0 6 3] 

T^-feX*S|5S'W#2 0 3 5 3~2 0 3 5 n it. ffi&m^VmmZ tlT V^ V^j£ 

f 
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(DWifrTkfrWm. (W i n d o w s T'lZ? U V K&H) , Hffi^P-V^V- 

fSRB, ftJBr^y^r-S/aXBISje (#^T^ U >t- i/ a >^T*©^M^ih^ 

[0 0 6 4] 

^^^tis^^jb^^o -ecDift^ u v-x^m^u 2 0 3 <z>p^rai5{c^ 

[0 0 6 5] 

z<d «£ o teffif$\z&z> y y-^fa^a^7A2 0 3 <D#t3g(co^T, 02© 

[0 0 6 6] 

®r^"y^-^3>2 0 2 l^fbtAP 1 jcfcory y-^©r^t7 

H#^fetl«, APIi^CTRL 2 0 3 l^-eOS^&ISb, 7?-fe*fftIPP 
CTRL2033 (C^^.^. 0 
[0 0 6 7] 

®T*"fe**!l»CTRL 2 0 3 3 tt, T V fe XtSPS^" 31 V Z Zftteoffi. ' &m 
iCjSUT, T^y 4r-*/a > 2 0 2 1 #W£LTVn£ y V-^Cfflli&AP 
HCTRL2 0 3 2^e,$#t§ o 
[0 0 6 8] 

A) "ett, _LfB®©T^-fe^^tC^f LT, 0 3 5 

*SRR#&v^«^, 7^J>r-i/3>2 0 2 1 #38f?LfcA P I 
[0 0 6 9] 

XftlWJS^-^;!/ 2 0 3 5 &#ibTf<D'J V - J*^© r # "fe **gP&^- x y ? 
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?tL£a p i {#13} ©M^h Lti7-^It3i:^t't^v^ T7V fr- 
iz ay 20 2 l tfg^Lfc u y-^'sc^aisff^fc-rtc. yy-xfi^n^ 

7A20 3 TOMIbf^*^ -CDD y-^.^\©T^-fe^M^{Cf^x.T. API 
[0 0 7 0] 

[0 0 7 1] 

-a-, APII1CTRL2 0 3 1^07ftXlf 5:111, T^U^r-J/a 
> 2 0 2 1 #|8f?l/fcA P I <Z>*Q:3l£^(Z>i; StfLMO S 2 0 1 {Cfcx., ^©M^ 

ZT-yvr-ys y 2 0 2 1 ICjg-To 

[0 0 7 2] - 

(D-hSaCDW^SfCioT. APIMU fro, fOAPIiaoTT^U 
^T-J/3>2 0 2 l^UV-^5:^jftSi^i, AP Ll^CTRL 2 0 3 2 
\Zfe%_Z> 0 APLMCTRL 2 0 3 2 ttT^'J ^T- 3> 2 0 2 1 i:§#tT 

v*su y-;*©'*fo& 5. . 

[0 0 7 3] 

ryy T-ym y 2 0 2 1 fry y-^©j|?iic5l#A p 1 u fro^A 

PlWlfei^t, APL^CTRL 2 0 3 2[C^S= APLflCT 
RL 2 0 3 2(i7^'J^r-i/3 > 2 0 2 1 fc-fitfgpUTV^y y - * <Z) >TO £ £fr#| 

[0 0 7 4] 

®os«2(i«iiB©iRf^jc«fcoT, u y-x^©r^-fe^si#««feti«, osi 

tiCTRL 2 0 3 4#-e<07*-fe;*g:fc$:lifEU T^iZXMJCTRL 2 0 3 
[0 0 7 5] 

®r^-fe^^#®ic*fbT> T^-fex^g|5s^s^-y;i/2 035 ^tiit^ 
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[0 0 7 6] 

(DT^-feXg^CDtcMbT, T i? -Z ^mm^MT - 7 )l 2 0 3 5 &#ibTf 

^, (DfflSff feiflfflo s 2 o i ic^as. 

[0 0 7 7] 

^$:MtS^t'©T^'J^-^3>2 0 2 1. U V-X^^y°n^^A2 0 3 
, iHMOS 2 0 l©^'J$fJ&^bfeAP I©ffiffi;&t5fro»©^l©3E#3! (1 

[0 0 7 8] 

^tiWffl'J y-^A©7^txi?«ofci^ (x^y y*4 oi), y v 
— .xn : i!iy°n ^7^2 o 3 &y^y ^r-^s > 2 021 #-eopy y— *^cdt# 

■fe^$gpg^&£^£^:r:y ?f -5 Uf^^4 0 2) „ ^xy^Ojg^, 7*12 
XflHStf&S©^ 7*4 0 3) , if^OS 2 0 1 iC7^y^-^3> 2 0 

2 1 #8ffUfeAP I %^:<D$. |RfflOS2 0 Hi, OSWAPI 

[0 0 7 9]. 

'jy-^fa^n^5A2 0 3tt, AP I &3#J*:5&L T^y^r-S/ 
3>2 0 2 1 ifi*<DV y-*£^##UT^£ £ V^fiNR&g^-TS Uff^4 
0 5) „ f LT, EfflOS 2 0 l*P>OAP £ * 7 7° 'J V 3 > 

2 0 2 1 CJIt Uf*;'^4 0 6) Q itltCJ:*;, U V - *^<DT 9 -fe *f£T L 
O-x-y y°4 0 7) , 
[0 0 8 0] 

ZKDffc, T^y^r-S/3>2 0 2 1 LTV^S y y-*<&#S[g:&#$8 

frsnfetS-^ Uf7^4 0 8) , 'J v-^f i^n 2 0 3 ttf ©«ftg 

#&?HMOS 2 0 1 {Cex.£ a mFSO S 2 0 1 il O S%i&(DA P I *Q.aS:*TJ& 
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5 {T^T-V^f^ 0 9) 0 'JV-^fa^ny7A2 0 3lt API^lMb 

7yj^r-i/3>2 0 2 1 7^<Z)U y-X£^#bT^3£V^#fB£ 
(X5^y 74 10) „ f IT, ifflOS 2 0 1^&©AP I Jg^Sr-e© 

Jl7^J^r-i/H>2 0 2 l ^ig-r (^f>y^4 11). itiJC «fc l J, ffiWL 

[0 0 8 1] 

2 03, m>mo s 2 o i <d^ ygty ^ibfcAP i ©sg«;&tfflafflra>^2 ©s* 

32 (2) <Z)S/->>r>;*.EIT?&£„ 

[0 0 8 2] 

Zltf)3|2<Z>^;fcM (2) T^U.^T — 2/3>2 0 2 1 *«%ff LfeAP I JC 

ioTiWcjy-^cTi'txs^feofe^ Uf»;^5 0i) , yy 
-^ts^n ^A2 o 3 ttrV uV — s/a > 2021 #-t<z>y y — y^cr* 

a > 2 0 2 1 JCjgi" y\5 0 4 ) 0 rtUCJ: 1;, UV-XA®79tX® 

[0 0 8 3] 

T^1?;*3S,K:n^-CM/&LTV l >&^yy''J >?r—>3 y 2 0 2 1 #Stfr 
L/fcAP I JCfcoTBffiKOU y-^^©T^i2XS^^feofe^-^ y*5 
0 6), 'J V-Xf I^n 2 0 3 (iT^'J >r-i/ 3^2 0 2 1 ^(D 'J V 

-xs\<DT V-txmmtf Uf*;^5'0 7) „ fi^if© 
T fro, 7^'J^r-i/3>2 0 2 l^T^tXlSx 

WfflIL/fc^^-©'jy-^A©7i't^i;t§^, #ifflos2 0i 

tc^-r Uf>y^5 0 9) „ 

[0 0 8 4] 

mmo s 2 0 1 it o s*&<dap i&s&frfc^ Uf^^s 10) „ u y 
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-Xfl^D^7A2 0 3tt, tfLMO S 2 0 1 fr&fflAP I S: * © * * 

T^u^r-s/s > 2021 Ait Uf«^5 id. Be&©u y- 

Uf>y^5 1 2) „ 

[0 0 8 5] 

J£*±tf> J: "5 (C LT 7 * -fe X*g|5&CD£ ^ U y - X ^CD 7 # -fey. ^rMPS 
tSt)fflT'$>5A\ |flM«OS t'^SWi ndowshUNI X© A P I 

[0 0 8 6] 

[0 0 8 7] 

*§-£fC, Wi n d o w s V^MSC/MPt" £ A P I £.LT&<D*j(Di$2bZ> B 

[0 0 8 8] 
(1) 7 7>fM-^>/ffJ*API 
CreateFi leA 
CreateFileW 

i 

OpenFile 

1 o p e n 

1 c r e a t 

GetOpenFi leNameA 
G e t O p e n F i 1 e N a m e W 
GetSaveFileNameA 
GetSaveFileNameW 

* 
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(2) 7 7 <4 )bt U-XA P I 
CloseHandle 
1 c 1 o s e 

(3) "7 7 -f )VZ2 hf — /#S& A P I 
CopyFileA 
CopyFi 1 eW 
MoveFileA 
MoveFileW 
MoveFileExA 
MoveFileE xW 
DeleteFileA 
DeleteFileW 
DragQueryFileA 
D r a g Q ueryFileW 

UN I Xfflft#, ES/IH»t5AP IlbTli^CtiO^S. 
[0 0 8 9] 

(1) 77^M-^>/»PI 
open 

c r e a t 

(2) 7 I 
close 

(3) :7y>f ;i/ 3b?-/ ;f£gfr A P I 
r e n a m e 

[0 0 9 0] 

<#&i > (7T-r;i/^--^>cf ic^^a^^f^e) z.ht>mw\sx^z>m& 

) 
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[0 0 9 1 ] 
[0 0 9 2] 

[0 0 9 3] 

[0 0 9 4] 
[0 0 9 5] 

n d o w s&tfUN I XtCfiV^Sgfii/fWflrrS A P I £ l/T&CDfcfiDtf&S. 
[0 0 9 6] 
Windows <Z>*§^ 
(1) fA>f7st-7°>API 
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CreateDCA 
Create DCW 

(2) r/UX^D-XAPI 
ReleaseDC 
ClosePrinter 

(3) ^'J>^I|{/APLiIAPI 
OpenPr inte rA 
OpenPr inte rW 
GetPrinterA 
GetPrinterW 
SetPrinterA 
SetPrinterW 
Send.MessageA 
SendMessageW 
PostMessageA 
PostMessageW 

UNIXffli^ 

(1) f/U^t-^API 

open • 

(2) ^A^^mA PI 
i o c t r 1 

(3) f/UX^D-XAPI 
close 

X 3 -D<DXmtf$>Z> 0 
[0 0 9 7] 

<#&1> (77^f )l*-7y^izWMMM^m&Z£t>mWlsX^2>m&) 
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[0 0 9 8] 
[0 0 9 9] 

>r jv z m o «rig« # & s 

*<DT7°v>r-i/-Ei > fimr ? Z> $. T*. t(DTy°V >r-*/a y<D7°V >#m$l* 

[0100] 

#CtC» ■ ^SP|g«©^JM £ tilt 1" £ #1 IC o VMTH&HJ?1*-3o 
[0101] 

6D^§-£lC, Wi n d o w sMUN I XlZ&WXEM/MW't £ A P I £ ITi^ 

[0 1 0 2] 

W i n d p w s 00^^ 
(1) fA>f^*-^>API 
CreateFi 1 e A 
CreateFileW 
Open F i 1 e 
1 o p e n 
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1 c r e a t 

(2) fA>f^^n-XAPI 
CloseHandle 

1 c 1 o s e 

UNIX0i^ 

(1) rA^xt-y>AP i 

open 

(2) -rA-f *W0A P I 
i o c t r 1 

(3) f-'U^i'D-XAPI 
close 

[0103] 

T ? -t xmm*gM"r - 7 Jl 2 0 3 5 1CT, ^(Z^f^tf) % £. fC#j£:ftg|5|gg(D 
^SS^fAM ?: o TfAH Xt - ^> A P. I g^^fe o fei^, T? 

[0104]. 
[0105] 

[0106] 

K^*I&&<fr#fg£§^|-<r3 A P I U KCDAP I 
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[0 10 7] 

^CD^-^-lC, Wind o w s ICfc ^TMU/M&-t& A P I £ L T & CD 0) # 

[0 10 8] 
Windows (D%& 
( 1 ) &3f/m&>&frA P I 
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a 

[0 110] 
[0111] 

o 

[0 112] 

<#?£4 > (m^mm<Dte^7 7 ^ jv i? b n L-cifcy&tf 

[0 113] 
[0 114] 
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£„ ^<Z)I§1^C, Wi n d o w s^UN I XtC £ V^^M/Wf SAP I £ 

[0 115] 
Windows (D%^ 
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WSASendTo 
WSAAsyncSelect 
WSAAs yncGetHos tByAddr 
WSAAs yncGe tHo s t ByName 
WSAAs yn cGe t Pr o t oByNumbe r 
WSAAs yn cGe t Pr o t oByName 
WSAAs yncGe t Se r vByPo r t 
WSAAs yncGe t Se r vByName 
WSACancelAsyncRe quest 
WSASe tB 1 ockingHook 
WSAUnhookB 1 ock i ngHook 
WSACleanup 
closesocket 
shutdown 
UNIXCDl^ 

accept 
bind 
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r e c v 

recvfrom 

socket 

select 

send 

s e n d t o 

closesocket 

shutdown 

[0 116] 
[0 117] 

[0118] 

<#&3> (7T-r;i/^n-x^{cm^j^s$:e^e) "Ttgffi^s>u, 'scat 77 

[0 11 9 ] 
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[0 12 0] 

■So 

[0121] 
[0 1 2 2] 

*©#^tC, Windows iC^^Tll/IJHtS A P I h IT^fiDt©^ 

[0123] 

(1) f/UXt-^>API 
GetWindowDC 
WindowFromDC 
GetDC 

G e t DC E X 

GetDesktopWindow 
GetDeviceCaps 
CreateDCA 
C r e a t e D CW 

(2) ^^-«A PI 
B i t B 1 t 
StretchBlt 

(3) f/UXi'D-XAPI 
DeleteDC 
ReleaseDC 
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[0124] 

i"-5^i:Tff^C)o Wi nd owsCfe^SD i r e c tDr a w&£;\ 
[0125]. 

$ & (c, * ^ i/>f -xvw e V R AM-T * - 7:7 U S/ 

[0126] 

[0127] 
[0128] 

[0 12 9] 
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a 

[0 13 0] 

Windows tfeVNTiS/ililtS A P I i: bt^ 

[0131] 

(1) 

CreateFileA 

Create Fil e W 

OpenFile 

1 o p e n 

1 c r e a t 

(2) 77^;i/^D-XAP I 

C 1 o s e H a n d 1 e 

1 c 1 o s e 

(3 ) ^CHZy^SA PI 

W i n E x e c 

CreateProcessA 
CreateProcessW 
ExitProcess 
UNI X(DW?& 
( 1 ) 77^jl/t-y>AP I 

open 
(2) 77^fiI/^D-XAP I 
close 
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[0 13 2] 

a 

[0 13 3] 

tik/fflW "t Z> A P I i: 1/ T & (Z> %j (D ifi & £ . 
[0 13 4] 

(1) 77^;i/(Z)^-f A^^>^gAP I 
SetFileTime 

(2) i/XrAHt©Ij|AP I 
SetSystemTime 

SetSystemTimeAdjustment 
[0 13 5] 

[0136] 
[0137] 
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[0 13 8] 

Wi nd o w s &C&V^MIS/0J$l1-<5 AP I tlT^®^©^ 
[0139] 

( 1 ) ^ntxfiA p i 

OpenProcess 

CreateProcess 

CloseHandle 

(2) *=eyifcft2AP I 
ReadProcessMemory 
WriteProcessMemory 
ReadProcessMemoryVlm 
WriteProcessMemoryVlm 

3 CD £ 5 & A P I (D^fiUZ <fc o T 7 U -fe f*f * ^ U ©#M £ f=. 3? ££§lfc 

[0 14 0] 

[0141] 
[0 14 2] 

JC J: oTPPM^^#7^fg7?&o£o Web - K ~t £ t=. tb CD * v h D 
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Windows (D$gj^ 
(1) jI^AP I 
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